IN THE UNITED STATES DISTRICT COURT 
FOR THE MIDDLE DISTRICT OF NORTH CAROLINA 


IN RE APPLICATION OF CAMERON 
FINDLAY FOR AN ORDER UNDER 

28 U.S.C. § 1782 TO CONDUCT Misc. Civil Action No. AD MICS 
DISCOVERY FOR USE IN FOREIGN 
PROCEEDINGS 


DECLARATION OF JAMES MEYER 


1. I, James Meyer, pursuant to 28 U.S.C § 1746, declare as follows: 


1.1. Tama solicitor and director of Egan Meyer Limited (“Egan Meyer”), the English 
solicitors instructed by the Applicant (“Mr. Findlay”). I, along with my fellow 
director Mr. Richard Egan, have the day-to-day oversight of my firm's 


engagement with Mr. Findlay, including his involvement in these proceedings. 


1.2. Mr. Findlay is a UK citizen. He began his career with the Metropolitan Police 
in London, where he spent the majority of his time working as a detective. He 
subsequently left that job to become a business and security consultant 
specialising in corporate investigations and asset tracing. Following a 10-year 
career in that field, he co-founded a music technology company in England and 


he continues to work on various business ventures. 


1.3. Ihave personal knowledge of the facts set forth herein, which are all true to the 


best of my knowledge and belief, except where they have been provided to me 
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by my client (and in respect of which privilege is not waived) or I have indicated 
that my knowledge is based on public information. I submit this declaration in 
support of Mr. Findlay’s application for an order under 28 U.S.C § 1782 (the 
“Application”) to conduct discovery for use in contemplated foreign 


proceedings. 


I should also note that this declaration refers to a number of allegations that have 
been made against the Respondents, Dechert LLP (“Dechert”) and Mr Neil 
Gerrard (a solicitor and former Partner of Dechert) in separate judicial 
proceedings. Although the allegations are, as set out below, very serious, the 
parties who have made them appear to have credible evidence in support of them, 
some of which I refer to below. Mr Findlay relies on these allegations upon 
information and belief in support of this Application. In doing so, I wish to make 
clear to this court that these allegations are awaiting final judicial determination 


from the relevant courts. 


SUMMARY OF MR. FINDLAY’S APPLICATION AND THE RELEVANT PARTIES 

This Application seeks discovery from an individual located in this district, 
Nicholas Del Rosso, and his company, Vital Management Services Inc. (“Vital”) 
(collectively, “Respondents”), for use in foreign proceedings Mr. Findlay 
intends to commence against the individuals and parties he believes hired the 
Respondents to help them attempt to steal confidential and proprietary 


information from him through a series of spear phishing attacks I describe below. 


2- 
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The Respondents live in this district and are not expected to be defendants in the 


foreign proceedings he is contemplating. 


Vital is a company which purports to provide investigative services located at 
1340 Environ Way, Chapel Hill, North Carolina 27517. It is my understanding 
that Mr. Del Rosso is the president, owner and sole employee of Vital. He resides 


in Chapel Hill, North Carolina. 


As further explained below, the facts of this case arise out of proceedings brought 
in the English courts in which Mr. Findlay acted as a witness. These proceedings 
were issued in September 2017 by Eurasian Natural Resources Limited 
(“ENRC”) against: its former lawyers, Dechert and ‘Mr. Neil Gerrard (the 
“Dechert Proceedings”). ENRC is a corporation incorporated in England & 
Wales and the holding company in a diversified natural resources group with 
extensive mining operations. The Dechert Proceedings were heard by a judge in 
the English High Court over 11 weeks between May and September 2021. Mr. 
Findlay gave evidence at the trial over three days. Judgment, in which ENRC’s 
claims wae comprehensively upheld by the Court, was handed down in May 


2022. 


Mr. Findlay seeks discovery for use in support of proceedings he intends to bring 
(the “Contemplated Proceedings”) against Mr. Gerrard and Dechert in the 


English Courts as a result of, among other things, Mr. Gerrard’s attempts to steal 
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confidential information from him by way of phishing! and spear-phishing” 
email attacks that occurred during the course of the Dechert Proceedings. As 
noted above, Mr. Findlay ve due to be a witness for ENRC in the Dechert 
Proceedings wile the hacking campaign against him was being waged. Mr. 
Findlay considers that the hacking campaign by Mr. Gerrard and Dechert 
amounts to an attempt to interfere with the judicial process and his testimony to 


the English court. As this court will understand, this is a very serious matter. 


As detailed below, Mr. Findlay has a good-faith belief that the Respondents have 
documents and information that are relevant to Mr. Gerrard’s efforts to illegally 
obtain his confidential information and will be of central importance to the 
Contemplated Proceedings (in relation to which see paragraph 6.2 below). Mr. 
Findlay therefore seeks in this Application discovery of such documents and 


information. 


ENRC’S EXISTING CLAIMS AGAINST MR. GERRARD AND DECHERT IN THE 
ENGLISH COURTS 


Between April 2011 and March 2013, ENRC engaged Mr, Gerrard and Dechert 
to conduct certain internal investigations and subsequently to advise ENRC on 
its engagement with the UK's Serious Fraud Office (“SFO”) (the “Retainer”). 


During the first 15 months of the Retainer: 


Phishing is the term used for the sending of malicious emails or text messages designed to trick the 
recipient into clicking on a link to a website containing malicious software. 

Spear-phishing involves the use, in the malicious emails or texts, of information specific to the recipient 
which is intended to increase the likelihood of deceiving the recipient. 


A- 
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(a) Mr. Findlay (who had worked for ENRC independently of Dechert and 
Mr. Gerrard on numerous occasions previously) was engaged (through his 
company Canani Capital Management AG, which traded as Bridge 2 
Limited (“Bridge 2”)) to provide consultancy services to ENRC, in 
connection with which he took his day-to-day instructions from Dechert; 


and 
(b) Mr. Findlay worked closely with Mr. Gerrard. 


ENRC later discovered what it alleged was (and what the English court has now 
found - in its judgment handed down in May 2022 - to be) highly improper 
conduct by Mr. Gerrard and Dechert. ENRC terminated Dechert’s Retainer in 
March 2013 and issued the Dechert Proceedings against them in September 2017 
in the English Courts. ENRC claimed in those proceedings that, in the course of 
the Retainer, Mr. Gerrard committed multiple dishonest or reckless breaches of 
fiduciary, tortious and/or contractual duties to ENRC in order to increase 
Dechert's fees and Mr. Gerrard’s personal profits at ENRC’s expense. More 


specifically, ENRC alleged, among other things, that Mr. Gerrard: 


(a) deliberately leaked ENRC’s confidential and privileged material to the 
national press on at least three occasions, knowing that this would be 


detrimental to ENRC; 


(b) made repeated secret adverse and highly prejudicial disclosures about 


ENRC to officers of the SFO, including at clandestine meetings; and 
5. 
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(c) secretly facilitated an approach to the SFO by a senior ENRC compliance 


officer as a whistleblower. 


In making the claim that Mr. Gerrard dettherately leaked ENRC information to 
the press, ENRC relied in particular on two witness statements Mr. Findlay 
submitted to the English Court, and his trial testimony, showing that he and 
another ENRC consultant, Robert Trevelyan, had been instructed by Mr. Gerrard 
to leak ENRC’s confidential and privileged information to The Times newspaper 


in summer 2011 (“The Times Leak”). 


In the judgment handed down by the English Court in the Dechert Proceedings 
in May 2022, ENRC’s claims against Mr. Gerrard were comprehensively upheld, 
and included findings of “extraordinary” and “almost unimaginable” 
misconduct by Mr, Gerrard, including that he had perpetrated The Times Leak 
(and later two other leaks) and that he gave wrong advice to ENRC purposefully 
to keep Dechert's Retainer going “by scaremongering”. Mr. Justice Waksman 
also held that Mr, Gerrard had “Jied continuously” in an attempt to cover up his 


wrongdoing.? 


HACKING ATTEMPTS AGAINST MR. FINDLAY IN 2018 
Between 11 April 2018 and 21 June 2018, Mr. Findlay believes that he was 
targeted with at least 90 spear-phishing emails (that he identified at the time, but 


potentially many more unidentified spear-phishing emails) sent to a business 


3 (2022) EWHC 1138 (Comm). 
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email address he used at that time, “cameron@powerchord.co.uk” (the “Spear- 


Phishing Emails”). 


Upon Mr. Findlay’s information and belief, the Spear-Phishing Emails were sent 


at Mr. Gerrard’s instruction and/or with his involvement in an attempt to: 


(a) find out what evidence Mr, Findlay had against Mr. Gerrard to support 


The Times Leak allegation and what he had told ENRC; and 


(b) intimidate Mr. Findlay into withdrawing his written statements to the 


English Court about this issue. 


Mr. Gerrard and Dechert’s role in orchestrating the Spear-Phishing Emails is 
evident from the timing and content of the Spear-Phishing Emails, as outlined 


below. 


First, the timing of the Spear-Phishing Emails coincided with Mr. Gerrard’s 
attempts to procure Mr. Findlay’s and ENRC’s withdrawal of the allegation that 
Mr. Gerrard had instigated The Times Leak, as illustrated by the chronology 
below. The information detailed in the chronology below has been provided to 


me by my client, Mr. Findlay, and/or is publicly available from court filings. 


(a) On 29 January 2018, ENRC issued a claim against Mr. Findlay in the 
English Commercial Court for breach of confidence in connection with 


Mr. Findlay's role in The Times Leak (the “ENRC-Findlay Proceedings”); 


J. 


Case 1:23-mc-00005-UA-JLW Document 3 Filed 02/24/23 Page 7 of 23 


(b) On 19 February 2018, the ENRC-Findlay Proceedings were settled by 
way of a settlement agreement between Mr. Findlay and ENRC. Further 
to this settlement, Mr. Findlay provided ENRC with a witness statement 
outlining, among other things, his and Mr. Gerrard’s involvement in The 
Times Leak (the “2018 Statement”). The fact of the settlement was clear 


from a publicly available order of the court; 


(c) On 19 and 27 February 2018, Mr. Gerrard’s solicitors, Clyde & Co LLP 
(“Clyde & Co”) wrote to Mr. Findlay personally at his home address 
notifying him that they were aware of the ENRC-Findlay Proceedings and 
asking him whether he had legal representation in those proceedings, 
which is indicative of Mr. Gerrard's desire to monitor Mr. Findlay’s 


ongoing role in the proceedings; 


(d) On6 March 2018, Mr. Gerrard filed an application to have certain parts 
of ENRC’s particulars of claim in the ENRC-Findlay Proceedings 
(“Findlay Particulars”) struck out. In a supporting witness statement, Mr. 
Gerrard asserted that the Findlay Particulars implicated him in The Times 


Leak without explicitly identifying him as the culprit; 


(e) On 14 March 2018; ENRC's solicitors, Hogan Lovells International LLP 
(“Hogan Lovells”), wrote to Clyde & Co informing them that “significant 
new evidence ha[d] come to light” which established that Mr. Gerrard had 


instigated The Times Leak; 
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(h) 


G@) 


On 11 April 2018, Mr. Findlay received (to his knowledge) the first of 
the spear-phishing emails. Examples of some of the spear-phishing emails 


are contained in Exhibit 1; 


On 13 April 2018, Hogan Lovells wrote to Clyde & Co enclosing 
amended particulars of claim in the Dechert Proceedings alleging that Mr. 


Gerrard had instigated The Times Leak; 


On 27 April 2018, Hogan Lovells wrote to Clyde & Co enclosing a 
redacted version of Mr. Findlay's 2018 Statement which alleged that Mr. 


Gerrard instigated The Times Leak; 


On 1 May 2018, Clyde & Co wrote to Mr. Findlay’s former solicitors 
asking him to withdraw the 2018 Statement, with the threat that a failure 
to do so may result in them bringing perjury proceedings against him 
(Exhibit'2, page 1). Sitting in the London High Court, Mr. Justice Bryan 
subsequently indicated he was “slightly surprised” by the letter and noted 
that a threat of this kind "in certain circumstances can itself be contrary 
to the solicitors' Code of Conduct" (Exhibit 3 at internal page 92). He 
ordered Clyde & Co to give an undertaking to the Court (for its own part) 
not to intimidate a further relevant witness in its communications with 


him (Exhibit 4); and 


On 21 June 2018, Mr. Findlay received (to his knowledge) the last of the 


Spear-Phishing Emails. 
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Second, the Spear-Phishing Emails contained material that seems designed to 


threaten and/or intimidate Mr. Findlay and, by elevating the seriousness of the 


communications, increased the likelihood that Mr. Findlay would click on the 


malicious links and/or intimidate him into withdrawing his allegations 


concerning The Times Leak: 


(a) 


(b) 


(c) 


(4) 


One email purported to be from the UK’s national law enforcement 
agency, the National Crime Agency (“NCA”), with the subject line 


“You’ve received a subpoena from the NCA” (Exhibit 1, page 5); 


Another email purported to be from the UK Secretary of State for Justice 
at the time, the Rt Hon David Gauke MP, and referred to the “Royal 
Courts of Justice”, which implies a threat of litigation (Exhibit 1, page 


4); 


Two emails which eee to have been sent by Mr. Findlay's wife, 
which distressed her and Mr. Findlay. Mr. Findlay’s wife’s name was 
known to Mr. Gerrard, who had met her and with whom Mr. Findlay had 
formed a close friendship with during the Retainer. Mr. Gerrard had 
invited Mr. Findlay and his family to visit Mr. Gerrard’s country house 


on at least one occasion in 2011; 


Three emails purported to relate to an on running set of proceedings 
between ENRC and Dechert relating to the fees charged by Dechert for 


its Retainer with ENRC, and purported to contain a link to “ENRC 
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Dechert Costs Judgment (BRIDGE2 LIMITED)” (Exhibit 1, pages 1-3); 


and 


(e) Numerous emails referred to Mr. Findlay’s former businesses, business 
partner and associates, implying that the sender had access to non-public 
and sensitive commercial information about Mr. Findlay, but that was 
known to Mr. Gerrard from their time working together (Exhibit 1, pages 


8 and 9). 


With one exception, Mr. Findlay believes that he realised that the Spear-Phishing 
Emails were not genuine and therefore believes that he did not click on the links 
contained in them. The exception is that Mr. Findlay recalls that he did click 
through on the link in one of the first spear-phishing email he received, not 
realising that it was malicious. Given how sophisticated the hacking campaign 
against him appears to be, Mr. Findlay is also unable to say for sure that he did 
not click on the links of other spear-phishing emails that he did not identify as 
suspicious. Mr. Findlay is therefore unable to say for sure whether the hacking 
campaign against him was successful. However, these hacking attempts, 
combined with the intimidating correspondence received from Mr. Gerrard and 
Dechert's solicitors (referred to above), caused him and his family significant 


stress and anxiety. 


In addition to receiving the Spear-Phishing Emails, in the period leading up to 
the Dechert/SFO Trial, Mr. Findlay believes that his home was covertly 
surveyed on several occasions by individual operatives, one of whom appeared 
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to be filming his house. Having received covert surveillance training in his role 
as a police officer, Mr. Findlay is capable of identifying this type of behaviour. 
These events led him to believe that his and his family's security was at risk and 


caused considerable distress to his wife and young daughter. 
As a result of the above mentioned events: 


(a) Mr. Findlay installed upgraded CCTV cameras and an access control 


system at his home in June and July 2018; 


(b) = Mr. Findlay was referred to a specialist therapist and prescribed anti- 


depressants for a period of two and a half years; 
(c) his wife began receiving therapy; and 


(ad) _ Mr. Findlay was asked by colleagues to step away from the day-to-day 
management of the company he ran at the time, Powerchord Limited (a 


music technology business). + 


Mr. Findlay intends to claim damages against Mr. Gerrard and Dechert in the 
Contemplated Proceedings so that he is recompensed for the losses he has 


suffered arising from these matters. 


PROCEEDINGS IMPLICATING MR. GERRARD, DECHERT, MR. DEL ROsSO, 
AND VITAL IN OTHER HACKING ATTEMPTS 


For the reasons mentioned above, Mr. Findlay has always suspected that the 
Spear-Phishing Emails were sent at Mr. Gerrard's instruction and he does not 


believe that there is anyone else who would have had an interest in hacking him. 
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However, without further evidence of Mr. Gerrard’s involvement, Mr. Findlay 


did not pursue the matter at that time. 


It is now’a matter of public record, however, as a result of various highly 
publicised proceedings filed in England and the United States (“US”), that it 
would appear Mr. Gerrard is implicated in multiple other hacking attempts 
targeting his and his clients’ opponents. These proceedings have also yielded 
evidence of the Respondents! apparent history of conducting cyber-attacks, such 
as the attacks launched against Mr. Findlay, at the behest of Mr. Gerrard and 


Dechert. 


Further, 'as set out below, Mr. Findlay has also been informed that evidence has 
come to light that appears to confirm that the same Indian hacking company that 
the Respondents apparently used to conduct other hacking attacks on the 
instructions of Mr. Gerrard also prepared and sent the Spear-Phishing Emails to 


him. 


I should emphasise that Mr. Findlay is not a Plaintiff or Defendant to any of the 
proceedings set out: below and the evidence set out below is drawn from 


documents that are publicly available. 


Background to the various legal actions against Mr. Gerrard and Dechert 
I understand that the various legal actions I refer to in séction 5 above all stem 
from Mr. Gerrard and Dechert's engagement, between 2014 and 2020, by the Ras 


Al Khaimah Investment Authority (““RAKIA”), the investment authority of the 
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Emirate of Ras Al Khaimah (“RAK”), I further understand, on the basis of the 
publicly available statements of case served in the various legal actions, that that 
the engagement involved, in general terms, Mr. Gerrard and Dechert assisting 
RAKIA and the Ruler of RAK (the “Ruler”) in their investigation into RAKIA’s 
former CEO, Dr, Khater Massaad, who was suspected of misappropriating 
government funds. As part of their engagement, I understand that Mr. Gerrard 
and Dechert also investigated known associates of Dr. Massaad such as Mr. 
Farhad Azima (a US businessman) and Mr. Karam Al Sadeq (RAKIA’s former 


General Counsel), 


Mr. Azima and Mr. Al Sadeq subsequently issued proceedings in the English 
Courts in 2016 and 2020, respectively, against Mr. Gerrard and Dechert in which 
they allege (in their statements of case), among other things, that they were 
targeted by hacking, phishing and spear-phishing attacks authorised by and/or 
coordinated with the assistance of Mr. Gerrard and Dechert. J understand that the 
English solicitors, Stokoe Partnership Solicitors (“Stokoe”), representing Mr. Al 
Sadeq in his lawsuit against Mr. Gerrard and Dechert (the “Al Sadeq Claim”) 
were also the targets of such attacks, Stokoe have separately issued proceedings 
against Mr. Gerrard and Dechert for their involvement in these attacks. As I 
explain further below, I understand that evidence disclosed in the proceedings 
issued by Messrs. Azima, Al Sadeq and Stokoe directly implicates the 
Respondents in the attacks targeting these individuals and suggests that they 


were acting on the instructions of Mr. Gerrard and Dechert and/or with their 
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involvement. Mr, Azima's most recent Particulars of Claim in his proceedings 
are at Exhibit 5; the Particulars of Claim in the Al Sadeq Claim are at Exhibit 


6. 


Proceedings issued by Mr. Azima against Mr. Gerrard and Dechert 

I understand, based a the statements of case served in Mr. Azima’s proceedings 
against Mr. Gerrard oni Dechert in the English Courts, that Mr. Azima (and 
others associated with him, including Dr. Massaad) were targeted with over 150 
spear-phishing emails in mid-2015. Over a year later, in late summer 2016, 30GB 
of Mr. Azima’s hacked confidential and/or private data was posted online. As a 
result of the following evidence disclosed in the proceedings, I understand that 
Mr. Azima alleges that the Respondents, instructed by Mr. Gerrard and Dechert 
(acting, in turn, at the behest of RAKIA and the Ruler), orchestrated this hack in 
an effort to implicate Mr. Azima in Dr. Massaad’s alleged misappropriation 


scheme: 


(a) Based on bank statements and witness evidence filed in the proceedings, 
Mr. Azima alleges that two Indian “hack for hire” firms, CyberRoot Risk 
Advisory Private Limited (“CyberRoot”) and Cyber Defence and 
Analytics, were engaged by Vital to carry out hacking work for RAKIA. 
Mr. Azima further claims that both firms were specifically instructed by 
Mr. Del Rosso to hack Mr. Azima’s emails and computers and were paid 
ve $1 million by Vital for their services (Exhibit 5, pages 31-33). 


RARIA has admitted, in its Defence to Mr. Azima’s proceedings (Exhibit 
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7), that the Respondents were engaged by Dechert to undertake work 
relating to its investigation into Dr. Massaad and that this work included 
instructing CyberRoot (Exhibit 7, page 11) (although RAKIA denies that 


such instruction included hacking Mr. Azima); and 


(b) According to an affidavit filed in the proceedings by Mr. Stuart Page (a 
private investigator working for the Ruler), during the course of his 
engagement with RAKIA, Mr. Gerrard and other advisors to the Ruler 
were provided with regular “Project Update” reports prepared by an 
Israeli intelligence company, Insight. These reports, which have belatedly 
been produced in discovery in Mr. Azima’s proceedings, include extracts 
from emails which were obviously hacked. According to Mr. Page (Mr. 
Page’s affidavit is attached at Exhibit 8), efforts were made by Mr. 
Gerrard and other advisors to the Ruler to conceal Insight’s work for 
RAKIA and the Ruler from the English Courts. These efforts included Mr. 
Gerrard leading a “mock trial” training session in Switzerland in 
December 2019 dustag which he trained individuals to provide perjurious 
evidence to the English Courts to cover up Insight’s involvement. Mr. 
Page also reports that Mr. Gerrard told him during this trip to Switzerland: 
“if they ever believe or naive that we are behind the hacking, then this 
thing is going to drag on for years” (Exhibit 8, pages 9-10). I understand 
that Mr. Azima alleges that this was clearly an admission by Mr. Gerrard 


that RAKIA (with Mr. Gerrard’s involvement) had hacked Mr. Azima. 
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In his ree Defence in the Azima proceedings in English Court, Mr. Gerrard has 
admitted receiving at least some of the Project Update reports but claims to be 
unable to plead materially to the contents of the reports because of an alleged 
weak memory and “difficulties in processing information efficiently, in 


particular information from text” (while he was a Partner at Dechert) (Exhibit 


9, page 35). 


Mr. Azima has brought separate proceedings against the Respondents in respect 
of the hacking in the United States District Court for the Middle District of North 


Carolina.4 


Proceedings issued by Stokoe against Mr. Gerrard and Dechert 

Stokoe issued proceedings in the English Courts® in summer 2021 against 
various private investigators, Mr. Gerrard, and Dechert. Stokoe's Particulars of 
Claim are at Exhibit 10. I understand, based on the statements of case filed by 
Stokoe, that they allege that the phishing and spear-phishing attacks against them 
in 2020 formed part of a wider campaign by Mr. Gerrard and Dechert, assisted 
by the Respondents, to improperly obtain confidential information relating to Mr. 
Al Sadeq’s source of funding for the Al Sadeq Claim (the “Stokoe Proceedings”). 
I understand that this allegation is based on the following (documentary and 


witness) evidence served in the Stokoe Proceedings: 


M.D.N.C. Civil Case No. 20-cv-00954-WO-JLW. 
Case Nos. QB-2020-002218 and QB-2020-002492. 
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(a) In late January 2020, shortly after the Al Sadeq Claim was first issued, 
Mr. Del Rosso called one of his private investigator contacts, Mr. Patrick 
Grayson, to ask him to find out how Mr. Al Sadeq was funding the Al 


Sadeq Claim; 


(b) Further to Mr. Del Rosso’s call to Mr. Grayson, steps were taken by 
various private investigators to obtain information about the funding of 
the Al Sadeq Claim. Such steps included successful attempts in spring 
2020 to access Stokoe’s main bank account and obtain transactional data, 
as well as the copying of financial records from a bank account held by 
Maltin PR (the public relations firm assisting Mr. Al Sadeq with the Al 


Sadeq Claim); 


(c) Parallel requests were made by Mr. Grayson in or about April 2020 to 
obtain three months of corporate banking transactions of Hogan Lovells. 
Hogan Lovells have no involvement in the Al Sadeq Claim, they do 
however represent ENRC in its proceedings against Mr. Gerrard and 
Dechert (as mentioned above). A few months later, in March 2020, Mr. 
Grayson sent himself a chart showing alleged links between the various 
individuals and entities depicted, including many entities connected to the 
Al Sadeq Claim. The chart also references ENRC, its Luxembourg parent 


company and Hogan Lovells; 


(d) Around the same time, Clyde & Co (the English solicitors acting for Mr. 
Gerrard and Dechert) wrote to Stokoe in April 2020 on Mr. Gerrard's 
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instructions asking a series of questions about the funding of the Al Sadeq 


Claim and threatening an application for security for costs; and 


(e) I understand that in light of the above, and the following, Stokoe allege, 
in their siaieseuk of case, that Mr. Del Rosso’s enquiry to Mr. Grayson 
was made pursuant to the instructions of Mr. Gerrard and/or Dechert: (i) at 
the time of the attacks targeting Stokoe in 2020, the Respondents, Mr. 
Gerrard and Dechert had a well-established professional relationship in 
the context of their work together for RAKIA; (ii) Mr. Gerrard and 
Dechert are defendants to the Al Sadeq Claim and therefore have an 
interest in its funding (as confirmed by Clyde & Co’s letter at 5.13(d) 
above), compared with the Respondents who have no obvious interest of 
their own; and (iii) in light of their involvement in Mr. Azima's hack (as 
explained above), Mr. Gerrard and Dechert had the means and propensity 
to order such attacks and to rely on Mr. Del Rosso for his assistance to 


carry out these attacks. 


5.14 Mr. Al Sadeq and Stokoe applied in February. 2021 to the US District Court for 
the Middle District of North Carolina for an order against the Respondents to 
conduct discovery for use in the Stokoe Proceedings under 28 U.S.C § 1782.6 
The order was granted in October 2021, with Mr. Del Rosso’s motion to quash 


being denied in March 2022. Mr. Del Rosso and Vital filed an objection to the 


e M.D.N.C. Misc. Case No. 1:21-mce-00006-UA-LPA. 
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Magistrate Judge’s denial of the motion to quash, and that objection is currently 


pending before U.S. District Court Judge William J. Osteen, Jr. 


Recent developments 


On 23 February 2023, my firm, Egan Meyer, received a letter from the English 


solicitors acting for Mr. Azima, Burlingtons LLP, addressed to Mr. Findlay. In 


that letter, Burlingtons set out “matters that have come to light in the course of 


[Mr. Azima’s] investigations into the Indian ‘hack for hire’ firm, CyberRoot Risk 


Advisory Private Limited’. A copy of this letter is at Exhibit 11; in summary: 


a) 


(b) 


(c) 


(d) 


Mr. Azima instructed a corporate investigations firm, Athena Intelligence 
(“Athena”) in respect of his proceedings against Mr. Gerrard and Dechert. 
The letter explained that Athena received an anonymous ‘Wetransfer’ link 
on 21 November 2022 which appears to have been from a whistle-blower 


at CyberRoot. 


Athena analysed the data transferred to it and discovered what appeared 


to be copies of malware and malicious spear-phishing emails. 


That data shows that Mr. Azima had been targeted by CyberRoot with 


those spear-phishing emails. 


The data also shows that Mr. Findlay was a target of phishing hacks 
instigated by CyberRoot: messages prepared and addressed to Mr. 
Findlay's email address, cameron@powerchord.co.uk, appear within the 


data provided to Athena (Exhibit 11, page 2). 
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6.1 


6.2 


6.3 


CONTEMPLATED PROCEEDINGS AGAINST MR. GERRARD AND DECHERT IN 
THE ENGLISH COURTS 


As explained above, Mr. Findlay intends to issue the Contemplated Proceedings 
against Mr. Gerrard and Dechert (as directly or vicariously liable for Mr. 
Gerrard’s wrongdoing), as the directing mind(s) behind the hacking campaign 
against him, rather than the Respondents, whom Mr. Findlay does not expect to 


be defendants to the contemplated proceedings. 


Mr. Findlay is presently unable to say with certainty whether or not the Spear- 
Phishing attacks against him were successful (although, as noted, he does recall 
clicking through on at least one malicious link). This is a question that may only 
be resolved through ‘the discovery process, including in the Contemplated 
Proceedings. As matters stand, -Mr. Findlay intends to bring a harassment claim 
against Mr. Gerrard and Dechert founded on, among other things, the anxiety 
and distress caused to him and his family by the hacking campaign. Naturally, 
Mr. Findlay reserves his right to amend his claim against Mr. Gerrard and 
Dechert to include a claim for misuse of confidential information to the extent 


that evidence emerges that the attempts to hack him were successful. 


I should also note, for completeness, (and without waiving privilege), that Mr. 
Findlay has instructed lawyers to bring criminal.complaints in the appropriate 
jurisdictions. Mr. Findlay also reserves his right to adduce any discovery 


produced by the Respondents in support of any foreign criminal proceedings. 
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6.4 


6.5 


As demonstrated by the above evidence, the Respondents are alleged, acting on 
Mr. Gerrard’s instructions, to have played key roles in orchestrating the above 
mentioned hacking, phishing and/or spear-phishing attacks targeting the 
opponents of Mr. Gerrard and his clients, including Mr. Findlay. Accordingly, 
upon information or belief, the Respondents have documents and information 
that would constitute significant relevant evidence in the Contemplated 


Proceedings, particularly with regard to the following key issues: 


(a) _ the extent of the Respondents’ involvement in the sending of the Spear- 


Phishing Emails; 
(b) who the Respondents received their instructions from; and 
(c) the motivation for sending the Spear-Phishing Emails. 


So far as I am aware, there is no rule prohibiting a litigant in England from 
seeking evidence through a 28 U.S.C. § 1782 or similar proceeding for use in 
English proceedings. Rather, the English courts permit litigants to choose the 
manner in which they obtain the evidence which they need to support their case, 
which may include both documentary and testimonial evidence obtained from 
U.S. 28 U.S.C. § 1782 proceedings, provided the materials comply with English 
requirements regarding disclosure of evidence to opposing parties. I believe that 
the English courts would be receptive towards any discovery ordered from the 
Respondents to these proceedings, and that the English courts would permit Mr. 


Findlay to rely on them in evidence at trial. 
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Pursuant to 28 U.S.C. § 1746, I declare under penalty of perjury under the laws 


of the United States of America that the foregoing is true and correct. 


Executed in London, England 
on the 24" of February, 2023. 


James Meyer 
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